Your first plugin: commercial-legal

You'll need the plugin installed (Module 1). No setup handy? Read along — the exhibit below shows what you'd see.

1. Get the contract (same one as Module 1 — Wickline's vendor paper, salted with landmines):

⬇ Sablefield ⟷ Wickline vendor agreement (Word) or plain text (.md)

2. Give Sablefield a real playbook — a review is only as sharp as the positions behind it, and Module 1's quick setup wrote only sensible defaults. The cleanest way to fill in real positions without re-running the whole interview is the profile editor, /commercial-legal:customize. Run it, then give it Sablefield's purchasing-side positions — it shows what's there, takes your positions, and confirms each:

/commercial-legal:customize

When it asks what you'd like to change, hand it Sablefield's purchasing-side positions — written so the Wickline contract will trip them (give the whole list, or go one at a time):

Set my purchasing-side playbook:

- Liability cap — vendor capped at 12 months' fees paid or payable, with
  carve-outs above the cap for confidentiality breach, data breach, and IP
  indemnity. Cap base must be "fees paid in the 12 months preceding the claim."
  Never accept a 3-month cap base, or a cap that applies "without exception."
- Indemnity — vendor indemnifies IP infringement AND data-breach / privacy
  claims. Never accept an indemnity that excludes data incidents.
- Data protection — vendor signs our DPA before any service touches
  customer-site data. Never accept the vendor training its models on our data,
  even "de-identified."
- Term — auto-renewal only with a cancel window of 30 days or less, plus
  termination for convenience on 30 days' notice. Never accept a 90-day notice
  window with no termination for convenience.
- Governing law — Delaware, New York, or California are fine; escalate
  jury-trial waivers.
- The one thing — nobody trains on imagery from our customers' facilities.

/commercial-legal:customize is also how you change any single position later — tell it what to change and it rewrites just that, flagging anything that would contradict the rest of your profile.
Source: commercial-legal · customize/SKILL.md

3. Now run the review skill on the contract. Send the command on its own (details on the same line stop it from firing):

/commercial-legal:review

When it picks up, attach the contract and tell it what you want — e.g. “We're Sablefield, the customer (purchasing side). Flag every deviation, and don't change anything.”

Or skip the slash and just ask, in one message (works in either app):

Use the commercial-legal plugin to review this attached agreement — we're Sablefield, the customer; flag every deviation, don't change anything.

Be as casual or as precise as you like. (One Cowork caveat: a playbook saved in step 2 may not persist there — Module 1's note — so it would review on standard positions; name your sharpest positions in the request if so.)

4. Watch for two moments. First the routing check: it should identify a services agreement with subscription features and propose vendor-agreement-review + the saas-msa-review overlay — and ask “Sound right?” Say yes (or correct it). Then comes the memo. Here's what it looks like on our contract, shortened for the page:

5. Two things to notice while it runs. The findings carry two ratings, not one — legal risk (can we get sued?) and business friction (does this cost us time, money, or goodwill?) — because the 90-day renewal trap is mild law but expensive business. And the memo ends with options, not a decision. The decision is yours; it just builds out whichever path you pick.

6. Compare against the answer key: this contract has at least six planted landmines (the table above shows five — §11.1's one-way assignment clause is the quiet sixth). How many did your run catch? Anything it caught that we didn't plant?